=== APIkurir Shipping ===
Contributors: devapikurir
Tags: shipping, woocommerce, indonesia, courier, cod
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
WC requires at least: 8.0
WC tested up to: 9.8

Multi-courier shipping rates, COD support, order creation, tracking, and webhooks for Indonesian couriers — powered by APIkurir.

== Description ==

**APIkurir Shipping** integrates your WooCommerce store with the [APIkurir](https://apikurir.id) courier aggregator API, giving your customers access to real-time shipping rates from multiple Indonesian couriers at checkout.

= Features =

* **Multi-courier rates** — JNE, J&T, SiCepat, ID Express, Ninja, Lion Parcel, SAP, AnterAja, Pos Indonesia, and more.
* **COD support** — Automatically shows COD-eligible couriers when customers choose Cash on Delivery.
* **Province / City / District dropdowns** — Cascading address selectors powered by APIkurir location data replace the default WooCommerce address fields for Indonesia.
* **Multiple shipping origins** — Configure multiple warehouses or stores; products can ship from different origins.
* **Automatic shipment creation** — Orders are automatically pushed to APIkurir when payment is received.
* **Tracking & webhooks** — Receive real-time status updates from couriers via webhooks; tracking info displayed on admin and customer order pages.
* **WooCommerce Blocks support** — Full compatibility with the block-based checkout (Cart & Checkout blocks).
* **HPOS compatible** — Fully compatible with WooCommerce High-Performance Order Storage.

= How It Works =

1. Sign up at [apikurir.id](https://apikurir.id) and get your API credentials.
2. Install and activate the plugin.
3. Enter your API ID and API Key in **WooCommerce → APIkurir Shipping**.
4. Add at least one shipping origin (warehouse/store).
5. Add the APIkurir Shipping method to a WooCommerce Shipping Zone.
6. Customers will see real-time courier rates at checkout.

== External services ==

This plugin connects to the **APIkurir API** (`https://live.apikurir.id/v2` and sandbox `https://sandbox.apikurir.id/v2`) to provide shipping functionality.

What the service is used for:
- Fetching province/city/district location data used in checkout selectors.
- Fetching courier and service availability/rates.
- Creating shipment orders after checkout/payment.
- Tracking shipment status and handling shipment updates.

What data is sent and when:
- During shipping-rate requests: origin/destination location codes, shipment type (regular/COD), selected courier/service, and package details (weight/quantity/value context).
- During shipment creation/tracking/cancel operations: order shipping recipient info (name, phone, address/district), selected courier/service, and order shipping metadata required by the API.
- During account/API checks from admin settings: configured API credentials (API ID and API Key) are used to authenticate API calls.

Service provider legal pages:
- Terms and Conditions: https://apikurir.id/terms-condition/
- Privacy Policy: https://apikurir.id/privacy-policy/

This plugin also connects to **OpenStreetMap services** on the APIkurir settings page:
- OpenStreetMap map tiles (`https://{s}.tile.openstreetmap.org`) display the map used to select an origin pinpoint. The browser sends the visitor's IP address and standard HTTP request metadata when map tiles are loaded.
- Nominatim (`https://nominatim.openstreetmap.org/search`) searches for an address after an administrator enters at least three characters. The search text, the fixed country context "Indonesia", the administrator's IP address, and standard HTTP request metadata are sent to Nominatim.

OpenStreetMap service policies:
- Tile Usage Policy: https://operations.osmfoundation.org/policies/tiles/
- Nominatim Usage Policy: https://operations.osmfoundation.org/policies/nominatim/
- Privacy Policy: https://osmfoundation.org/wiki/Privacy_Policy

== Source code and build ==

This plugin includes both built assets and editable source files.

- Built checkout blocks asset: `assets/build/checkout-blocks.js`
- Editable source file: `src/checkout-blocks/index.js`
- Build tooling config: `package.json`, `package-lock.json`, `webpack.config.js`
- Build command: `npm run build`

The bundled Leaflet library is licensed under the BSD 2-Clause License. Its editable upstream source is available at https://github.com/Leaflet/Leaflet/tree/v1.9.4.

== Installation ==

1. Upload the `apikurir-shipping` folder to the `/wp-content/plugins/` directory, or install through the WordPress plugin screen.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Navigate to **WooCommerce → APIkurir Shipping** to configure your API credentials.
4. Add at least one shipping origin under the **Origins / Warehouses** tab.
5. Go to **WooCommerce → Settings → Shipping** and add the **APIkurir Shipping** method to the appropriate shipping zone.

== Frequently Asked Questions ==

= Do I need an APIkurir account? =

Yes. You need to register at [apikurir.id](https://apikurir.id) to obtain API ID and API Key. A sandbox mode is available for testing.

= Does this plugin support COD (Cash on Delivery)? =

Yes. When a customer selects COD as the payment method, the plugin automatically fetches COD-eligible courier rates.

= How do I secure the webhook endpoint? =

Set a **Webhook Secret** in **WooCommerce → APIkurir Shipping**. Your webhook sender must send the same secret in one of these:
- `X-Apikurir-Webhook-Secret` header (recommended), or
- `X-Webhook-Secret` header, or
- `Authorization: Bearer your_webhook_secret`.

Requests with missing/invalid secret are rejected.

== Changelog ==

= 1.0.3 =
* Harden cached manifest validation, filter short-circuit behavior, metadata validation, and redirect handling.

= 1.0.2 =
* Pin checksum verification to the exact immutable package URL offered by WordPress.

= 1.0.1 =
* Add a secure self-hosted update distribution channel for non-WordPress.org installations.

= 1.0.0 =
* Initial release.
* Multi-courier rate calculation via APIkurir API.
* COD support with automatic rate filtering.
* Province / City / District cascading dropdowns at checkout.
* Multiple shipping origins with per-product assignment.
* Automatic shipment creation on order payment.
* Tracking info display on admin and customer order pages.
* Webhook handler for real-time courier status updates.
* WooCommerce Blocks checkout support.
* HPOS compatibility.
